Can I remove a tag from already indexed data?

mrtolu6 · ‎10-31-2017

Is it possible to remove a tag from indexed data? Fox example if I have an app named 'TA-App' and it had a tag for #dhcp, #dns and #email, would I be able to remove the #email tag using the gui by disabling that tag? Or do I need to disable it then delete the index data to remove the tag?

somesoni2 · ‎10-31-2017

Tags are evaluated at search time and are not stored with indexed data so disabling tags would be sufficient.

Can I remove a tag from already indexed data?

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Accelerating Observability as Code with the Splunk AI Assistant

Join the Conversation

Can I remove a tag from already indexed data?

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Accelerating Observability as Code with the Splunk AI Assistant